There is a cool life-hack that I learned from my colleague: you associate .dll files with Dependency Walker, and now whenever you try to "run" a .dll file, it opens Dependency Walker for its analysis.

The problem is that there are two version of Dependency Walker: one 32-bit and another 64-bit. And it is recommended to use version of the same bitness for a .dll:

Yes. Dependency Walker will work with any 32-bit or 64-bit Windows module. There are 32-bit and 64-bit versions Dependency Walker. All versions are capable or opening 32-bit and 64-bit modules. However, there are major advantages to using the 32-bit Dependency Walker to process 32-bit modules and the 64-bit Dependency Walker to process 64-bit modules. This is especially true when running on a 64-bit version of Windows, which allows execution of both 32-bit and 64-bit programs. The 32-bit subsystem on 64-bit Windows (known as "WOW64") has its own private registry, "AppPaths", "KnownDlls", system folders, and manifest processing. Only the 32-bit version of Dependency Walker can access this 32-bit environment, which is needed to accurately process a 32-bit module. Likewise, only the 64-bit version of Dependency Walker can fully access the 64-bit environment, so it should always be used for processing 64-bit modules.

Is there a way to associate 32-bit dlls with 32-bit version of Dependency Walker and 64-bit dlls with 64-bit version of Dependency Walker? I'm particularly interested in answer for Windows 7 or 10.

  • Most easiest way would be to someone to write a In-between program which you assign to open DLL files. Then that program should decide which Dependency walker to launch. – AEonAX Feb 10 '17 at 9:10
  • "Is there a way to associate 32-bit dlls with 32-bit version of Dependency Walker and 64-bit dlls with 64-bit version of Dependency Walker?" - A 64-bit process can only reference 64-bit dependencies. – Ramhound Apr 4 '17 at 20:45

Created a python-based tool for this purpose: https://github.com/mmatrosov/DllDispatcher

The tool is pretty straightforward. As it is mentioned in the corresponding readme, you associate .dll with DllDispatcher.bat file, which calls DllDispatcher.py file, which analyses the .dll content and determines whether the provided dll is 32-bit or 64-bit. Based on this, it then calls one of the two provided applications. Paths to the applications are simply hard-coded at the beginning of DllDispatcher.py file.

I found no easy way to determine whether a dll is 32-bit or 64-bit. GetBinaryType only works for .exe files. For a dll one should either actually load the library and then pass the handle to IsWow64Process(), or manually parse the header of the dll (it has PE file format). I chose the latter. It is less robust, but more fast. I think robustness is not a big issue, since it is unlikely for the PE format to change in the near future, and this solution does not have to be completely bullet-proof.

  • Grand cheers! :) – bertieb Apr 4 '17 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.